MITRE’s ATT&CK knowledge base now gives formal entries to attacks on AI systems, including prompt injection and the hijacking of a company’s own AI agents, alongside new ways of getting around multifactor authentication (MFA), SecurityWeek reported Monday. Version 20, released Oct. 13, matters beyond the security team: ATT&CK is the shared vocabulary that defenders, vendors and auditors use to describe attacker behavior and to show which behaviors an organization can detect, so AI systems now join the list that security programs are expected to cover.
What Happened
ATT&CK, maintained by the nonprofit MITRE, is a free public catalog of the tactics and techniques attackers use in real intrusions, from first access to data theft. Security teams map their monitoring to it to find blind spots, and vendors describe their products’ coverage in its terms. According to MITRE’s October 2026 updates page, the main change in v20 is expanded coverage of recent attacker activity. The Enterprise section now lists 227 techniques and 479 sub-techniques, and the catalog as a whole tracks 182 groups and 971 pieces of software.
SecurityWeek counted nine Enterprise additions. Prompt injection, in which an attacker slips instructions to a large language model (LLM), is now two techniques: one for instructions typed straight into the model’s interface and one for instructions hidden in content the model reads, such as a web page or document. A new technique covers attackers using an organization’s own AI agents to steal data. New sub-techniques cover poisoning web content to sway what AI search tools and assistants recommend, and disrupting malware analysis that relies on LLMs.
Other additions cover stolen application-specific passwords, separate passwords some services generate for individual apps, which can sign in without an MFA prompt, and getting past CAPTCHA bot checks by solving or avoiding them. An existing entry on compromised software dependencies and development tools now includes configuration files for code editors and AI coding agents. MITRE said the additions capture “how adversaries get around Multi-Factor Authentication, bot checks, and AI systems,” SecurityWeek reported.
For industrial control systems (ICS), a new campaign entry tracks attacks on internet-exposed programmable logic controllers, the small computers that run pumps and valves, at more than 30 Minnesota water and wastewater utilities, which left operators locked out. MITRE says attribution for those intrusions remains unconfirmed. A second campaign documents an AI-assisted breach of Mexican government institutions that crossed from office networks into operational technology and reached a municipal water utility.
Among groups, MITRE added Nimbus Manticore, which SecurityWeek described as an espionage group associated with Iran’s Islamic Revolutionary Guard Corps, and the ransomware service The Gentlemen. It updated Salt Typhoon, described as China-backed, to cover attacks on network edge devices, and North Korea’s APT38 to reflect a shift from financial theft to software supply-chain attacks. The release also adds 15 detection strategies, six for Enterprise and nine for ICS, backed by 38 analytics. On mobile, it restores a technique for delivering malicious apps outside official stores and adds NGate, malware that relays payment card data over a phone’s contactless chip so attackers can withdraw cash at ATMs.
Why It Matters
Formal ATT&CK entries change what boards and regulators can reasonably ask. A security team that maps its coverage to ATT&CK will now show gaps for AI-related attacks if it has no way to spot an agent being turned against company data or a model taking orders from a poisoned document. Executives deploying AI agents that can read email, files or customer records should ask whether those systems are monitored against these techniques.
The MFA entry is a reminder that the protection depends on every sign-in path. App-specific passwords can bypass the prompt entirely. The coding-agent change treats developer tools as part of the software supply chain. The water-utility campaigns add documented cases for critical infrastructure operators assessing exposed control equipment.
What to Watch
- How quickly security vendors and in-house teams remap detections and reports to v20.
- Whether later releases add more AI-agent techniques as attacks on them mature.
- Whether any government or company confirms who was behind the Minnesota water-utility intrusions.
